Privacy & Safety

In short

Ghush.xyz is built so you can report a bribe without telling us who you are. We ask for no account, no phone verification and no national ID. If you tick “I want to stay anonymous”, we do not store your name, email or phone number at all — the fields are discarded before the report is saved, not hidden afterwards.

What we keep

Always

• What you typed into the report: department, service, division, thana, office, headline, description, amount and outcome.
• The date and time the report was submitted.
• A count of how many people have opened the report.
• Any photo or document you chose to attach.

Only if you give it

• Your name, email address or phone number, when you leave the anonymity box unticked.
• The name of an official, if you fill that optional field in.
• Your contact number on a lost-item report — that one is public on purpose, so a finder can call you.

What we do not do

• We run no advertising network and no third-party analytics such as Google Analytics.
• We do not sell, rent or share submissions with anyone.
• We do not ask for your national ID, date of birth or address.

What is public and what is not

Assume everything on a report page is visible to anyone on the internet, including:

• the headline, description, department, location, amount and outcome;
• any attached photo or document;
• an official’s name, if you entered one;
• the contact name and phone number on a lost-item report.

These are never shown on the site and are visible only to a site administrator:

• your name, email and phone on a bribe report or a local-crime report.

Staying anonymous

The anonymity box is ticked by default. Leave it ticked and there is nothing in our database that points back to you — not a hashed identifier, not an account, nothing.

We do not keep a log tying an IP address to a submission. Rate limiting uses the address to count recent requests, but that counter expires on its own and is never written next to a report.

Third parties

Two outside services are loaded by pages on this site:

• Fonts and icons come from Google Fonts and cdnjs. Your browser fetches files from them, which means they see the request.
• supportkori.com provides the small “support us” button. Its script loads on every page and follows its own privacy policy, not ours. We never pass it anything you typed into a report.

We do not send any submission, contact detail or attachment to any third party.

Traffic counting

We keep our own count of how many times each page is opened, so we know which parts of the site people actually use. What is stored is the page address, the date and the language — nothing else. No IP address, no cookie identifier, no device fingerprint, and nothing that links a page view to a report.

Cookies and local storage

We set no advertising cookies. What the site does store:

• a session cookie, which lets the site show a form error back to you and stops one person voting on the same suggestion twice;
• a CSRF token, which stops another site from submitting a report in your name;
• report_view, lost_view, crime_view and per_page — your list-versus-grid choice and how many rows you like per page;
• a small note in your browser’s local storage remembering which notifications you have already seen, so the same one does not pop up twice.

All of it stays on your own device. Clearing your browser data removes every trace.

We also use Google Analytics to count visits and see which pages people read. It sets its own cookies. We have turned on IP anonymisation and turned off Google’s advertising signals and ad personalisation, so reading a report here does not feed an advertising profile. Your report itself is never sent to Google. A browser “Do Not Track” setting or any content blocker will stop it loading at all.

Photos and files

Attachments are stored on our own server and served from our own domain. We do not upload them to any third-party service.

A photo can carry more than what is in the frame — location data, a device name, a reflection, a face in the background, a letterhead with a file number. Look at your file before attaching it. On the local-crime form, please do not upload anything where a person’s face is recognisable.

Staying safe

• Describe what happened, not who you are. “A clerk at the counter” is safer than a detail only you could know.
• Think hard before naming an individual. An unproven public accusation can expose you to a defamation claim under Bangladeshi law, and the risk falls on you, not on us.
• If you are in immediate danger, call 999 first. This site is a record, not an emergency service.
• This site cannot arrest anyone, recover your money or force an office to act. It builds a public record that is hard to ignore.

Your choices

Want a report taken down, or a detail corrected? Email teamhaliX@gmail.com with the report’s web address and what needs to change.

Because reports are anonymous, we usually cannot verify that a request comes from the person who submitted it. We will still read every request and remove anything that is abusive, false, identifies a private individual, or puts someone at risk.

A removed report disappears from the site and from every statistic immediately. Administrators can restore a removal that turns out to have been a mistake, and can erase a record permanently.

Changes to this page

We update this page when the site changes. The date at the top always says when it last moved. There is nothing to “accept” — continuing to use the site is how you agree to it, and you can stop at any time by simply not submitting anything.

Questions: teamhaliX@gmail.com. See also our Terms of Service.